We have an application that, along with many things, does some changes to Active Directory (add/remove user from group, change attribute values on user, etc).
We are now in the process of redesigning it (from "spaghetti-code" into a more layered solution). The Active Directory management functions is something we would like to abstract out to some degree in the domain layer, but at the same time, most functions are very technology dependent.
Should we place all Active Directory access code in the data access layer along with our DB-access, or is it ok to create a active directory library of functions and call into this library directly from the domain model? That makes the domain object persistent aware and that's probably a bad idea?
Or should all Active Directory access instead be performed in the service layer instead and not even involve the domain layer?